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Abstract — We present and prove the correctness of an efficient 
algoritlim tliat provides a basis for all solutions of a key equation 
in order to decode Gabidulin (Q-) codes up to a given radius r. 
This algorithm is based on a symbolic equivalent of the Euclidean 
Algorithm (EA) and can be applied for decoding of ij-codes 
beyond half the minimum rank distance. If the key equation has 
a unique solution, our algorithm reduces to Gabidulin's decoding 
algorithm up to half the minimum distance. If the solution is not 
unique, we provide a basis for all solutions of the key equation. 
Our algorithm has time complexity 0{t'^) and is a generalization 
of the modified EA by Bossert and Bezzateev for Reed-Solomon 
codes. 

I. Introduction 

A special class of rank-metric codes was introduced by 
Delsarte Gabidulin |2] and Roth |3 |. These codes are also 
called Gabidulin {Q-) codes. Kotter and Kschischang recently 
constructed network codes based on Q-codes [|4]- 

In II2I, Gabidulin presented an algorithm for decoding Q- 
codes up to half the minimum (rank) distance with a symbolic 
equivalent of the Euclidean Algorithm (EA). Paramonov and 
Tretjakov fS] and independently Richter and Plass ||6l, Q gave 
a generalization of the Berlekamp-Massey Algorithm (BMA) 
for decoding of ^/-codes up to half the minimum distance. 
This algorithm was proved and extended by Sidorenko et al. 
in This generalization of the BMA yields a basis for all 
solutions of the key equation for decoding of Q-codts up to a 
given radius, if there is no unique solution. 

In this paper, we present an algorithm that provides a 
basis for all solutions of the key equation using the symbolic 
equivalent of the EA. Our algorithm is a generalization of the 
Bossert-Bezzateev Algorithm (ERA) from The BBA was 
applied for decoding of interleaved Reed-Solomon (RS) codes 
beyond half the minimum distance using the EA. 

This paper is organized as follows: In Section|IIl we give the 
required definitions and state the problem. Section Ulllprovides 
the algorithm and in Section HVl we prove the correctness of 
the algorithm. The paper ends with a conclusion in Section IVl 

II. Definitions and Problem Formulation 

A. Linearized Polynomials 

5-codes are defined by means of linearized polynomials (see 
e.g. IfTOl ). Let (7 be a power of a prime and let us denote the 
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Frobenius q-power by: 



(1) 



A linearized polynomial over F^™ is a polynomial of the form 

t 

= (2) 



i=0 



with li e Fqm . If the coefficient It ^ 0, we define the q-degree 
by deg^L(a;) = t. 

An important property of linearized polynomials for all 

a, 6 e and all Pi, e F, is: 



L{Pia + (32b)^PiL{a)+hL{b). 



(3) 



Consequently, any linear combination of roots of a linearized 
polynomial L{x) is also a root of L{x). 

Let F{x) and G{x) be linearized polynomials over F^™. 
The symbolic product of F{x) and G{x) is: 



F{x)®G{x) = F{G{x)). 



(4) 



If dcgqF{x) — tp and dcggG{x) = to, then dcgg{F{x) ® 
G{x)) ~ tp + tQ. The symbolic product satisfies associativity 
and distributivity, but in general it is non-commutative, i.e.: 
Fix)(g)G{x) ^G{x)®F{x). 

We call G{x) a right symbolic divisor of A[x), if A{x) = 
F{x) (g) G{x) for some linearized polynomial F{x). These 
operations convert the set of all linearized polynomials into a 
non-commutative ring with the identity element a;[°l = x. 

We define a symbolic equivalent of the Extended Euclidean 
Algorithm (SEEA). Let R-i{x) = B{x) and Ro{x) = A{x) 
be two linearized polynomials with deg^ B{x) > deg^ A{x). 
The right symbolic greatest common divisor (rsgcd) is calcu- 
lated by the following recursion: 



R-i{x) 



Qlix) 

Q2{X) 



Roix)+Ri{x) 
i?i(x) +i?2(a;) 



(5) 



Rj-2{x) = Qj{x) ® Rj-i{x) + Rj{x) 
Rj-i{x) = Qj+i{x) (g) Rj{x), 



where deg^ Ri{x) < deg^ Ri-i{x). The last non-zero remain- 
der Rj{x) is the rsgcd{A{x) , B (x)) . 



Let Ui{x) and Vi{x) be polynomials, which can be calcu- 
lated recursively; 



Ui{x) = -Q^ix) «) U^^i{x) + U,^2{x) 
V^{x) = -Q^ix) ® V^^l{x) + V,-2{x), 



(6) 



with =0, Uq{x) =a;["l and V-i{x) = x™, Vb(x) = 0. 

By means of these polynomials, we can write each remainder 
as a combination of the input polynomials A{x) and B{x): 

R^{x) = U,{x)®A{x)+V^{x)®B{x). (7) 

An important property of the polynomials from the SEEA is: 



deg U^{x) + deg R^-l{x) = deg B{x). 



(8) 



The proof of (O is similar to the proof for the usual EA ifTTl . 



B. Gabidulin Codes and Their Key Equation 

AG- 
length: 



A ^-codeword is a vector c G ¥^m. , where n is the codeword 



c = (co,ci, . . . ,c„_i). 



(9) 



This vector can be mapped on an to x n matrix C with entries 
from ¥q. The rank norm rankg(c) is the rank of C over F^. 

For n < m, a linear {n, k) ^-code over F^m is defined by 
its {n — k) X n parity check matrix H (see 12]): 



H 



hi 



, [n-fe-l] 



h 



4^' 



[n-fc-l] 



h 



/in 

•t'n 



(10) 



where /ii, . . . , ft,„ e Fgm are linearly independent over F^. 
The minimum rank distance d of the code Q is defined by: 



d — min{rankq(c) | c G t/, c 7^ 0}, 



(11) 



and is d = n — k + 1. 

The transmitted codeword c is corrupted by an additive error 
e with Ci G F^™ of rankg(e) = t: 

r = c + e, (12) 

where r is the received vector with G F^m . We use a t x 71 
matrix Y of rank t with elements from F, to write: 



E • Y — i?2, ■ . ■ ,Et) • Y, 



(13) 



with El, E2, ■ . ■ , Et from ¥qm are linearly independent over 
¥q. The syndrome s is calculated by: 

s = r • = e . = (50, ^1, . . . , Sd-2), (14) 

and can also be represented as a linearized polynomial: 

5'(a;) =^5',xW. (15) 

The most important part of decoding Q-codes is solving 
the following key equation in order to find an error span 
polynomial A.{x) and an auxiUary polynomial n{x). A(x) 
contains all linear combinations of Ei,E2,.-.,Et (fT3] i as 
roots. 



Theorem 1 [2^ Let the syndrome S{x) and the minimum 
distance d be known, then the key equation for Q-codes is: 



n{x) = K{x) ® S{x) mod xl'^-il, 



(16) 



where VL{x) and h-{x) are linearized polynomials with the 
constraints: 



deg Vt{x) < deg A(.t) 



(17) 



In this paper, we restrict ourselves to solving the key equation. 
The decoding procedure afterwards can be done as explained 
e.g. in 12 • In the following, let r denote the decoding radius. 

C. Solving the Key Equation up to Half the Minimum Distance 

Gabidulin presented in I2] a method to solve the key 
equation using the SEEA if dcg^A(2;) < t = [^^J ■ The 
Gabidulin algorithm is similar to the algorithm by Sugiyama 
et al. for RS codes ifTTl and is shown in Algorithm [T] In 
this procedure, the SEEA runs with the input polynomials 
R-i{x) = .tI'^^i] and Ra{x) = S{x) (Lines [TBT i until the 
degree constraints of Line |6] are fulfilled. Line [8] yields the 
solution to the key equation, where a G F^m is an arbitrary 
constant factor Often, a is chosen such that A(a;) is monic. 
Similar as for RS codes, it can be shown that the polynomials 
A{x) and n{x) are unique except for the constant factor a. 



Algorithm 1: Solving the Key Equation if r 



d-l 



m 



Input: Syndrome S{x), x^"^ ^1 
Initiahze : i 4- 0, <- x^'^^^K Rn{x) ^ S{x), 

U-i{x) ^ 0, Uoix) ^ a;[°l 
1 whUe R^{x) 7^ do 



i ^ i + 1 

Calculate Qi{x) and Ri{x) such that: 

R^-2{x) = Qi{x) ® Ri-i{x) + R,{x) 

U,{x) ^ ~Qi{x) ® U,_i{x) + Ui^2{x) 

if deggi?,_i(x)> [^J anddegqR,{x)<[^\ then 
|_ break 



A{x) <— a ■ Ut{x) and Vt{x) a ■ Ri{x) 
Output: A(a;), n{x) 



Note that a proper A(.t) has ^-degree t\ — deg^ A(a;) < r 
and contains all linear combinations of tx linearly independent 
elements from F^™ as roots. In practice, if Algorithm [T] fails, 
decoding can be done with our algorithm that we provide in 
Section |IlI] 

D. Problem Formulation 

The problem of finding all solutions of the key equation if 
T > [^^J can be formulated as follows. 

Problem 1 Let an integer r, with < t < d — 1, the 

syndrome S{x) and x^"^"^^ be known. Assume, S{x) results 



from an error vector e with rankg(e) < r ( 114b . Find all pairs 
of polynomials {A(a;), f2(a;)} with 



degg Vt{x) < degg A(.t) = t, 
such that the key equation il6\ is fulfilled. 



(18) 



We want to solve this problem using the SEEA in an 
efficient way. The restriction rankg(e) < r means that we 
limit the decoding radius to t. We introduce tq: 

_^J+ro. (19) 

Of course, the key equation ( fT6] l can be solved with standard 
methods (e.g. Gaussian elimination) with complexity O(t^) 
operations in F^m. However, we want an efficient solution. 

In the following, we give an efficient algorithm to solve 
Problem [T] that has complexity 0{t^). The main results of 
our paper are Algorithm |2] and Theorem |2] 

III. The Algorithm for Solving the Key Equation 

In this section, we give an efficient algorithm (Algorithm |2]l 
based on the SEEA which solves Problem [T] with complexity 
0{t^). We explain the different steps of Algorithm |2] in this 
section and give the proofs in Section |IV] 



Algorithm 2: Basis for all Solutions if t > 



Input: Syndrome S{x), d, r 
Initialize : i<— 0, j^O, R-i{x)i 
U-i{x) ^ 0, Uoix) ^ 
Ao(a;)^.T[ol,Po(a:) 

1 while R^{x) ^ do 

2 
3 
4 

5 
6 
7 
8 
9 

10 



-Six) 



Ro{x) ^Six) 



+ j^j + l 
Calculate Qi{x) and Ri{x) such that: 

Ri~2{x) = Qi{x) ® Ri-i{x) + R,{x) 

Uiix) ^ -Qi{x) ® Ui-i{x) + U^-2{x) 
while dcgg Ui{x) — deg^ Aj_i(.t) > 1 do 
Aj(a-) ^ (g) Aj_i(x) 
Pj{x) ^ .tW ®Rj^i{x) 
i ^ i + 1 
/\j{:x) ^ U^{x) and Pj{x) ^ Ri{x) 



11 Calculate A-^, P-^ using 
Output: A^, 



Algorithm |2] executes the SEEA (|5]l with the input polyno- 
mials R-i{x) = xf'^"^! and Ro{x) = S{x). In each step i, the 
SEEA returns the remainder Ri{x) and the polynomial Ui{x) 
(|6]l. This corresponds to Lines [T] until |5] of Algorithm |2] 

The g-degree of the remainder Ri{x) is decreasing in every 
step, but not necessarily by one. Equivalently, the g-degree of 
Ui{x) is increasing in every step of the SEEA, but also not 
necessarily by one. Hence, 

degg R^+l{x) < dcgg R^{x) - 1, 

deg^ Ui+i{x) > degg Ui{x) + 1. 



(20) 



The missing degrees are then filled up as given in Lines |6] 
until |9] of Algorithm |2] This definition assures that there exist 
polynomials Ai{x), Pi{x) of each q-degree from to d — 2. 
This is shown in Lemma [T] 

Lemma 1 There exist polynomials of each degree from to 
d — 2 in each set {Ai{x)} and {Pi{x)}. 

Proof: At first assume that deg^ Ui+i{x) ~ dcgg Ui{x) + 
1 and deg^ = degg Ri{x) — 1 for all i. Hence, all 

Ui{x) = Ai{x) and all Ri{x) = Pi{x) have different degrees. 

Now, consider the case when some degrees have to be filled 
up in Line s|6] until |9] Assume, that the q-degree of the (i — l)th 
remainder decreases by more than one, i.e.: 

dcg^ Ri-i{x) = dcgq R,^2{x) - S with S > I. (21) 

Since degg Ri{x) < dcggRi^i{x), we know using Line |4] 
from Algorithm m 

degg Q.,{x) = degg R^-2{x) - deg^ Ri-i{x) = S. (22) 

With the calculation of Ui (x) (Line |5]l, we obtain: 

degg U,{x) = degg [/,_i(x)+degg Q^{x) = degg Ut-i{x)+6. 

(23) 

Hence, if the degree of the remainders decreases by 6 in step 
i, then the degree of Ui+i{x) increases by S in step j + 1. If 
we multiply Ri{x) symbolically from the left with x'^l and 
do this ((5—1) times, we fill up the 5 — 1 missing degrees of 
the remainders. The same holds for the Ui{x). 

Due to (l8]l, the g-degree of the last calculated Ui{x) is d — 2 
and the g-degree of the last remainder is 0. Thus, all degrees 
from to c? — 2 exist in the sets {Ai{x)} and {Pi(x)}. ■ 

If polynomials have different g-degrees, they are linearly 
independent. This becomes clear, if we write the coefficients of 
the polynomials as vectors. Consequently, with Lemma [T] the 
polynomials {Ai{xy\ and {Pi(x)} are linearly independent. 

Figure [T] shows an example how the gaps are filled up. The 
upper half of this figure shows the g-degrees of Ri{x), Ui{x) 
and the lower half the g-degrees of Pi{x), Ai{x). For example, 
there is a g-degree difference of 2 between Ri{x) and R2{x). 
Consequently, in the third step, degg U'i{x) = degg U2{x) + 2. 
The lower half of the picture shows that after filling up these 
g-degrees, all g-degrees from to d — 2 exist. 

Subsequently, we define a subset of these polynomials 
(Line [U of Algorithm IS: 

X = {i I degg A,(a;) < r A degg P^{x) < r}. (24) 

In Lemma |2] we show that the set X determines 2to + 1 pairs 
of polynomials {Ai{x) , Pi{xy\ , which we denote by: 

A^ = {A,{x)\i (zX) and P^ ^ {P,{x)\i (^X). (25) 

The following linear combinations of polynomials provide all 
solutions of Problem [T] (see Theorem |2]i: 

A(x)=^AAf(x) and - ^ /3,Pf (x), (26) 



deg, Ui{x) 




Fig. 1. Filling up the gaps in the degrees (d = 11) 

with /3i 6 Fgm. The definition of I assures that dcg^ A(.t) = t 
and dcgg il{x) < r. Lemma |3] gives the proof that these linear 
combinations satisfy the key equation (fT6] l. In Theorem |2] we 
prove that there are only (g™)2To+i solutions of Problem [T] 
and that these linear combinations provide all solutions. 

Thus, Algorithm |2] provides a basis for all solutions of 
Problem[T] The algorithm only requires a complexity of 0{t'^) 
operations in F^m and is a generalization of the BBA ||9l- The 
two algorithms are equivalent if m = 1, i.e. if Fgm = Fg, 
since then a 1*1 = a for all elements from F^. 

IV. Proof of the correctness of the Algorithm 

In order to prove that Algorithm |2] solves Problem [T] we 
show with Lemmas [T| and |2] that each of the sets A-^ and 
P-^ consists of 2ro + 1 linearly independent polynomials. 
Afterwards, we prove that the linear combinations from (|26] | 
fulfill the key equation (Lemma |3]l and that they give all 
solutions of Problem [T] (Theorem |2]i. Lemma |4] gives some 
properties that we need for the proof of Theorem |2] 

Lemma 2 The set I ^ {i \ dcg^ Ai(a;) < r A deg^ Piix) < 
t} (I24I | has cardinality 2tq + 1. 

Proof: At first assume, that dcg^ Ui+i{x) ~ dcg^ Ui{x) + 
1 and dcgg Ri+iix) = dcg^ Riix) - 1 for all i. With dH): 

degg U^{x) + deg, = deg, B{x) - I = d - 2. (27) 

The remainder Rm{x) with deggi?m(a;) = r — 1 determines 
the smallest i in the set I as deggi?i(a;) is decreasing with 
increasing i. The polynomial Un{x) with degg[/„(a:) = t 
determines the largest i as deggC/i(a;) is increasing with i. 
If degg[/„(a;) = t, we know with dZTl i that dcggi?„(a-) = 
d-2-T. Hence, with (fT9] i: 



If some degrees have to be filled up, we know from 
Lemma[T]that the sets contain all degrees. Therefore, the num- 
ber of polynomials in I does not change, only the elements 
change and the cardinality is also 2tq + 1. ■ 

Thus, with Lemma [T] and [2] each set A-^ and consists 
of 2ro + 1 linearly independent polynomials. 

Lemma 3 Let and be the sets of polynomials calcu- 
lated by Algorithm^ Any pair of polynomials {A(x),r2(x)} 
calculated by the linear combinations from ( 1261 ) satisfies the 
key equation ( II6I 1 with the degree constraints from ( II8I 1. 

Proof: For each Ri{x) and Ui{x), the following holds: 

Ri{x) = U,{x) ® S{x) mod x^'^-^\ (29) 

hence every polynomial that is a direct output of the SHEA 
satisfies the key equation. For the polynomials that are filled 
up as in Algorithm |2l we obtain: 

a;!*-'! ® Ri{x) = ® U^{x) (g) S{x) mod x^'^-'^\ (30) 

where k is the number of missing degrees between i and the 
current g-degree j ~ i + k. This is equivalent to: 



Aj (x) = Pj (x) ® S{x) mod arl'^-^l . 



(31) 



Calculating the linear combinations from (1261) . we obtain due 
to the distributivity of the symbolic product: 

^AAf(x) = [^A^'fW] (gS{x) mod (32) 

i i 

which satisfies the key equation ( fTSI l. Due to the definition of 
I from ( |24] |. also the degree constraints from ( fTsT i are fulfilled. 

■ 

Now, we rewrite the key equation ( fT6] l in order to prove 
that the linear combinations (|26] |, provide all solutions of the 
key equation. A(.t) is a linearized polynomial with q-degree 
T and hence has r + 1 unknown coefficients. Therefore, 

n{x) = HS{x)) mod x^'^-^^ 

+ a;W(Ao5i+Ai4'l) 
+ . . . 

+ a;M(Ao5, + Ai^™ , + ■ • ■ + A,4"') 
+ x[^+il(Ao5,+i + Ai^il + ■ • • + A,5i"l) 
+ . . . 

+ X^''-^\AoSd-2 + Ai^'Ig + ■ • ■ + Ar4-r-2)- 

We claim in ( fTSl l that deg„ 17 (x) < t and hence the coeffi- 
cients of x^'^l , 7 ■ • • , a;[''^^l must be zero. Consequently, 
we have d — 2 — t + 1 equations which fix some A^. 

We have to check if these equations are linearly independent 
in order to know how many coefficients are fixed. If we rewrite 
this linear system of equations in matrix form, we obtain: 



\I\ = dcg„ - dcg„ Rnix) + 1 = 2to + L (28) 



S-(A^,A^_i,...,Ao) 



0, 



(33) 



where S is a (d — t — 1) x (r + 1) matrix: 





/ 






s'r'' ■ 


■ S-r 


\ 








St-'' 


q[T-2] 


St+1 




s = 






c.[r-l] 




St+2 






I 




c.[-r-ll 

•^d-T-l 


o[r-21 

'^d-T 


Sd-2 





(34) 



For this matrix, the following lemma holds. 

Lemma 4 Let S ( 1341 ) be the matrix of syndrome elements 
satisfying the requirements of Problem [7] then rank(S) = 
min{d — 1 — r, t = rankg(e)}. 

Proof: We assume in Problem [T] that t = rankg (e) < r. 
With (fT3] l and (fT4l i. we can rewrite the syndrome by (see ||2l): 

s = E • Y ■ = E ■ X, (35) 

where the elements of the t x (d — 1) -matrix X in row i 

— 

and column j are: X^.j ~ x{ for i = 1,. . . ,t and j = 
1, . . . , d—1. The are linearly independent over ¥q as shown 
in ja. (|35]l yields: 

^f'=E^^f2;f+'l, (36) 

where fc is an arbitrary integer and I — 0, . . . ,d — 2. We can 
then decompose S as follows: 



S = XE = 


/ 


x[ 
x[ 


11 




... 4^' 
... 4^^^' 










V 


Id- 


2] 






J 








f 








4--^' ... 

4^-^' ... 


4°' 


\ 




\ 


4-' 




4^-' 




4°' 





(37) 



where Xi, . . . , and Ei, . . . ,Et are linearly independent 
over Fg. Both matrices, X and E, are linearized Vandermonde- 
like matrices. Such a matrix always has full rank ifTOl . There- 
fore, rank(X) = minjii— t — and rank(E) =min{t,T + 
1} = i. Since the rows of E are linearly independent, 

rank(S) = min{(i — r — 1, t = rank(j(e)}. (38) 



Theorem 2 Let and be the sets of 2tq + 1 linearly 
independent polynomials calculated with Algorithm |2] Let 
\J^\ < T < d — 1 and rankg(e) < r hold. 

Any pair of polynomials {A(x),r2(x)} satisfying the key 
equation ( II6I 1 with the degree constraints dlSb , can be cal- 
culated by the linear combinations of the polynomials from 
pi giygfi (I26I 1. That means, the sets , are a 
basis for all solutions of the key equation ( II6I 1. 



Proof: In the following, we show that only 2tq + 1 
coefficients of A(x-) can be chosen arbitrarily, if (fT6] l has 
to be fulfilled. Hence, the set of (q™)2To+i different linear 
combinations from ( |26] | constitutes the set of all possible A(a;). 

With ( |33] |, some coefficients of A(a;) are fixed. Lemma |4] 
shows that rank(S) = minjcJ — 1 — r, t = rankg(e)}. 

If rank(S) < — r — 1, then rank(S) — rankg(e) < 
d~ T ~ 1. We assume in the theorem r > [^j^J , hence this 
is equivalent to rankg(e) < [^^J and this error can always 
be corrected by Algorithm [T] 

Otherwise, rank(S) = d— 1 — r and that means that d—l — r 
coefficients of A(a:;) are fixed. Since the number of coefficients 
of A{x) is r + 1, the number of free coefficients is: 

T + 1 - (rf - 1 - r) = (2t - (rf - 1)) + 1 = 2ro + L (39) 

Hence, there are only (g™)2To+i possible A(a;). They can be 
calculated by the ((^™)2to+i jjjjear combinations from ( l26l ) as 
the linear combinations satisfy the key equation and fulfill the 
degree constraints. Equivalently, all n{x) can be calculated by 
the linear combinations from ( l26b . ■ 
The proof of Theorem |2] is one of the main results of this 
paper as it can be done in a similar way for RS codes. This 
proof is more descriptively than the proof given in [91 for RS 
codes. 

V. Conclusion 
In this paper, we have presented an efficient algorithm that 
provides a basis for all solutions of the key equation for 
decoding of ^/-codes up to a certain radius r. This algorithm 
requires C'(t^) operations in F^m and can be applied for 
decoding of tj-codes beyond half the minimum rank distance. 
Our algorithm is based on a symbolic equivalent of the EA 
and is a generalization of the BBA. 
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